STPA-based high-speed railway ATP system fault injection test method

Abstract

The invention discloses a high-speed railway ATP system fault injection test method based on STPA, and the method comprises the following steps: analyzing a high-speed railway ATP system through an STPA method, and recognizing a fault scene and safety requirements; based on the fault scene and the safety requirement, generating a finite-state machine model FSM of the high-speed railway ATP system by using a CoFI method; generating a test case on the finite-state machine model FSM by using a Wp method; and testing the ATP system of the high-speed railway by using the test case. The STPA method, the CoFI method and the Wp method are combined, a comprehensive and effective method is provided for the fault injection test of the ATP system, and the safety and reliability of the ATP system are ensured.

Description

Technical Field

[0001] The invention relates to an automatic train protection system, and in particular to a fault injection test method for an ATP system of a high-speed railway based on STPA. Background Art

[0002] With the continuous development of modern rail transit systems, the reliability and safety of the automatic train protection system (ATP) as an important part of ensuring the safety of train operation have attracted much attention. However, due to its complexity and criticality, the testing of the ATP system has become particularly important. During the testing process, it is necessary to identify potential faults in the system and verify whether the system's behavior in the face of these faults meets the design requirements.

[0003] System Safety Technical Process Analysis (STPA) is a system safety engineering method that aims to identify potential hazards in the system and determine how to design and operate the system to mitigate these hazards. The STPA method analyzes the system's functions, structure, and control strategies to identify various scenarios and factors that may cause system failure. In the testing of the ATP system, the STPA method can help identify the system's potential failure points and influencing factors, providing a basis for subsequent fault injection and testing.

[0004] After identifying potential faults, an effective fault injection testing method is needed. CoFI is a commonly used formal method to describe the control flow and state transitions of a system. The safety of the system can be evaluated by injecting faults into the control flow graph and observing the behavior of the system under fault conditions. In ATP system testing, the CoFI method can inject the identified fault scenarios into the control flow graph of the system to generate the finite state machine (FSM) of the system and observe the response of the system under these fault conditions.

[0005] ATP systems may contain uncertain transformations, which increases the complexity of testing. Traditionally, most techniques convert uncertain systems into deterministic systems before testing. However, the Wp method is a test case generation method that can be directly applied to uncertain systems. By deriving test cases from the state machine model of the system, it covers different behavioral paths of the system, thereby achieving the purpose of fully testing the system functions. This innovative method can directly deal with uncertain systems, avoiding the problems of information loss and increased complexity during the conversion process. Summary of the invention

[0006] The purpose of the present invention is to solve the problems in the prior art.

[0007] The technical solution adopted by the present invention to solve the technical problem is: to provide a high-speed railway ATP system fault injection test method based on STPA, comprising the following steps:

[0008] Apply the STPA method to analyze the high-speed railway ATP system and identify failure scenarios and safety requirements;

[0009] Based on the fault scenarios and safety requirements, the CoFI method is used to generate the finite state machine model FSM of the high-speed railway ATP system;

[0010] Use the Wp method to generate test cases on the finite state machine model FSM;

[0011] Use test cases to test the high-speed railway ATP system.

[0012] Preferably, the application of the STPA method to analyze the high-speed railway ATP system includes the following steps:

[0013] Define the purpose of the high-speed railway ATP system and clarify the objectives and scope of the high-speed railway ATP system, including the system's functions, environment and operating conditions;

[0014] Construct the control structure diagram of the high-speed railway ATP system, identify the controller, controlled object, sensor, actuator and their relationship in the system;

[0015] Identify unsafe control actions in control structure diagrams and summarize safety requirements.

[0016] Preferably, the unsafe control behavior includes:

[0017] The high-speed railway ATP system did not issue a deceleration command in the case of overspeeding;

[0018] The high-speed rail ATP system failed to detect the train speeding;

[0019] High-speed railway ATP systems misjudged speeding, leading to unnecessary deceleration or emergency braking;

[0020] High-speed rail ATP systems trigger emergency braking when it is not necessary;

[0021] The high-speed rail ATP system failed to trigger emergency braking when necessary;

[0022] The high-speed railway ATP system failed to effectively release the brakes, resulting in continued braking;

[0023] High-speed railway ATP systems report incorrect train positions, leading to incorrect control decisions;

[0024] The high-speed rail ATP system failed to update train location data in real time;

[0025] The communication between the high-speed railway ATP system and the trackside equipment is interrupted, and control instructions cannot be received or sent;

[0026] Communication data errors between the high-speed railway ATP system and trackside equipment lead to wrong control decisions;

[0027] The safety requirements include:

[0028] The high-speed railway ATP system must issue a deceleration command in the event of overspeed;

[0029] High-speed rail ATP systems must be able to detect train speeding;

[0030] The high-speed railway ATP system cannot arbitrarily apply deceleration or emergency braking;

[0031] The high-speed railway ATP system cannot trigger emergency braking at will;

[0032] High-speed rail ATP systems must be able to trigger emergency braking when necessary;

[0033] High-speed railway ATP systems must be able to effectively release brakes;

[0034] High-speed rail ATP systems must report correct train positions;

[0035] High-speed railway ATP systems must be able to update train location data in real time;

[0036] The communication between the high-speed railway ATP system and the trackside equipment cannot be interrupted;

[0037] The communication data between the high-speed railway ATP system and the trackside equipment cannot be wrong.

[0038] Preferably, the method of generating a finite state machine model FSM of a high-speed railway ATP system based on fault scenarios and safety requirements by using the CoFI method comprises the following steps:

[0039] Identify the observed control points (PCOs), input events, and output events in the control structure diagram of the high-speed railway ATP system;

[0040] To construct the rules of the finite state machine graph, first determine the initial state of the high-speed railway ATP system, then iteratively identify transitions and states based on the events occurring at the observation control points PCOs, and finally establish the rules of the finite state machine graph based on the identified transitions and states;

[0041] Construct normal behavior FSM diagram based on the rules of finite state machine diagram;

[0042] Construct abnormal behavior FSM diagram based on failure scenarios and safety requirements;

[0043] Add fault tolerance mechanism in FSM modeling process;

[0044] Verify whether the constructed FSM diagram meets the STPA requirements. If not, supplement the FSM diagram.

[0045] Preferably, the abnormal behavior FSM diagram is constructed based on the fault scenario and safety requirements, specifically including:

[0046] Add the transitions caused by the input events in the specified abnormal scenario to the normal behavior FSM diagram to construct the specified abnormal behavior FSM diagram;

[0047] Construct a state transition table STT using the transitions of the FSM for normal behavior and the FSM for specified abnormal behavior, fill in the empty cells in the transition table STT, identify events that occur at unexpected times, determine potential path transitions, and draw a potential behavior FSM diagram that includes all newly identified transitions.

[0048] Preferably, the normal behavior refers to the behavior when the high-speed railway ATP system provides services correctly, and the abnormal behavior refers to the behavior when the high-speed railway ATP system does not provide services correctly; different services are represented by FSM diagrams of different scenarios; and the services include train speed monitoring.

[0049] Preferably, the normal behavior FSM diagram construction process of the train speed monitoring scenario includes the following steps:

[0050] Determine the initial state as the state of the train at normal speed;

[0051] Iteratively identify transitions and states based on events occurring at the observation control points PCOs, specifically: the train communicator works, resulting in the input event "the train receives the movement authorization" triggering the action "received the movement authorization"; the next state is "ATP calculates the speed limit", in this state the train speed monitor calculates the speed limit and updates it, resulting in the input event "derives the speed limit" triggering the action "the speed monitor monitors the speed"; the next state is "monitoring speed", in this state the train speed monitor does not detect overspeeding, triggering the input event "not overspeeding" triggering the action "continue driving"; the next state is "normal form", in this state after the train drives out of the authorized section, triggering the input event "exit the section" triggering the action "issue a new movement request"; finally returning to the initial state;

[0052] The normal behavior FSM diagram of the train speed monitoring scenario is established based on the identified transitions and states.

[0053] Preferably, the abnormal behavior FSM diagram of train speed monitoring is obtained by adding the conversion caused by the input event in the specified abnormal scenario to the normal behavior FSM diagram of the train speed monitoring scenario; the specified abnormal scenario is the overspeeding of the train, which causes the input event "overspeeding" to trigger the action "send an alarm"; the next state is the "alarm state", in which two situations may occur. The first situation is that when a person receives the alarm, the "manual braking" state is entered. In the "manual braking" state, after the train speed returns to normal, the input event "return to normal speed" is triggered to trigger the action "stop braking" and return to the normal driving state; the second situation is that the overspeed alarm is not handled for a long time, then the "machine control state" is entered to take machine control braking, and after the train speed returns to normal, the input event "return to normal speed" is triggered to trigger the action "stop braking" and return to the normal driving state.

[0054] Preferably, the test case includes a first test set T1 and a second test set T2; the method of using the test case to test the high-speed railway ATP system includes the following steps:

[0055] Use the elements in the first test set T1 to test the IUT, and check whether each state is equivalent to the corresponding state in M. If yes, proceed to the next step; otherwise, consider that the IUT has an error and end the test;

[0056] The IUT is tested using the elements in the second test set T2 to check whether each state is equivalent to the corresponding state in M. If so, it is considered that the IUT has no errors, otherwise it is considered that the IUT has errors and the test ends.

[0057] The present invention has the following beneficial effects:

[0058] (1) The systematic safety analysis technology adopted in the present invention is STPA, which can effectively derive the unsafe control actions at each level and the corresponding safety requirements through strict analysis of the system hierarchy.

[0059] (2) CoFI is a commonly used formal method to describe the control flow and state transitions of a system. The safety of the system can be evaluated by injecting faults into the control flow graph and observing the behavior of the system under fault conditions. This method generates a control structure diagram of the high-speed railway ATP system through CoFI, and on this basis, combines the safety requirements of STPA to generate a finite state machine (FSM). This process ensures the accuracy of fault injection and system response, providing a reliable model for subsequent testing.

[0060] (3) The present invention uses a test method that can be used for non-deterministic systems, the Wp method, which derives test cases from the system's state machine model to cover different behavior paths of the system, thereby achieving the purpose of comprehensively testing the system's functions; compared with the traditional technology of first converting the uncertain system into a deterministic system for testing, the Wp method used in the present invention can be directly applied to the uncertain system. Finally, the present method uses the Wp method to generate test cases from the system's state machine model, especially for the uncertainty conversion part of the system, to verify whether the system's behavior in the face of different fault conditions meets the design requirements, thereby ensuring the safety and reliability of the high-speed railway ATP system.

[0061] The present invention is further described in detail below in conjunction with the accompanying drawings and embodiments, but the present invention is not limited to the embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 A method step diagram of an embodiment of the present invention;

[0063] Figure 2 This is the working principle diagram of ATP;

[0064] Figure 3 is a control structure diagram of an embodiment of the present invention;

[0065] Figure 4 This is a normal behavior FSM diagram of train speed monitoring according to an embodiment of the present invention;

[0066] Figure 5 It is a FSM diagram of specified abnormal behavior of train speed monitoring according to an embodiment of the present invention;

[0067] Figure 6 This is a potential behavior FSM diagram of vehicle speed monitoring according to an embodiment of the present invention;

[0068] Figure 7 A simple FSM diagram for generating test cases using the Wp method for an embodiment of the present invention;

[0069] Figure 8 A test tree schematic diagram of an embodiment of the present invention;

[0070] Fig. 9 Testing a FSM diagram containing a fault for the embodiment of the present invention;

[0071] Fig.10 An FSM diagram containing additional states is tested for embodiments of the present invention. DETAILED DESCRIPTION

[0072] See also Figure 1 FIG. 1 is a diagram showing steps of a method according to an embodiment of the present invention, comprising the following steps:

[0073] S101, applying STPA method to analyze high-speed railway ATP system and identify failure scenarios and safety requirements;

[0074] S102, based on the fault scenarios and safety requirements, the CoFI method is used to generate the finite state machine model FSM of the high-speed railway ATP system;

[0075] S103, using the Wp method on the finite state machine model FSM to generate test cases;

[0076] S104, use test cases to test the high-speed railway ATP system.

[0077] Specifically, the S101 applies the STPA method to analyze the ATP system and converts the safety requirements into LTL safety specifications. STPA (System-Theoretic Process Analysis) is a system safety analysis method proposed by Professor Nancy Leveson of MIT, which aims to solve the shortcomings of traditional safety analysis methods in complex systems. STPA is based on system theory and believes that system safety issues are not only caused by component failures, but may also be caused by complex interactions and control defects within the system. The basic concepts of STPA include:

[0078] System theory perspective: STPA views the system as a whole, emphasizing the interaction and collaboration between components within the system. It focuses on the behavior of the system in a specific environment, rather than just the function and reliability of individual components.

[0079] Cybernetics model: STPA uses cybernetics model to describe the operation of the system, and believes that the system realizes its function through control structure. The control structure includes controller, controlled object, feedback path, etc.

[0080] Safety constraints: STPA prevents accidents by identifying and analyzing the safety constraints of a system. Safety constraints are conditions that a system must meet during operation to ensure its safety.

[0081] The steps of STPA include:

[0082] Define the purpose: Clarify the goals and scope of the system, including the system's functions, environment, and operating conditions.

[0083] Establish a control structure model: construct a control structure diagram of the system, identifying the controller, controlled object, sensor, actuator and their relationships in the system.

[0084] Identify unsafe control behaviors: Identify unsafe control behaviors that may occur during the control process, such as failure to provide control, providing incorrect control, etc.

[0085] Analyze the causes of unsafe control behaviors: Analyze the potential causes of unsafe control behaviors, including control algorithm defects, inaccurate feedback information, system interference, etc.

[0086] The Automatic Train Protection (ATP) system is an important system for ensuring the safe operation of trains in railway transportation. Its core functions include monitoring the speed, position and signal status of the train, and automatically performing braking operations when necessary to prevent accidents such as overspeeding and collisions. Among them, speed monitoring and control are the key functions of the ATP system.

[0087] The ATP system consists of on-board equipment, trackside equipment, a central control system and a communication network. The system obtains the train's operating status and track information in real time through a series of sensors and communication devices. The on-board equipment receives the signal information sent by the trackside equipment and calculates and judges according to the preset safety rules (such as speed limit, signal status, etc.). If potential dangers are detected (such as speeding or running a red light), the system will automatically take measures to slow down or emergency brake to ensure the safety of the train.

[0088] The purpose of the high-speed railway ATP system is to ensure the safety of trains running at high speeds. By monitoring the speed, position and signal status of the train in real time, the ATP system can automatically take braking measures when potential dangers are detected to prevent overspeeding, conflicts and other incidents that endanger train safety.

[0089] Objectives of the high-speed railway ATP system: 1. Speed ​​monitoring and control: Continuously monitor the running speed of the train to ensure that it runs within the permitted range. This includes taking appropriate control measures in different speed monitoring areas (such as the ceiling speed monitoring area and the target speed monitoring area). 2. Preventing speeding accidents: Through preset safety rules, when the train speed exceeds the limit, the system issues an alarm and performs braking operations to avoid safety hazards caused by speeding. 3. Automatic braking intervention: Automatically perform braking operations when necessary, which are divided into weak common braking, medium common braking, maximum common braking and emergency braking according to the degree of speed overlimit. 4. Support different operating modes: According to the operating mode (driver braking priority or equipment braking priority), the ATP system can intervene in the braking operation of the train to varying degrees. 5. Interaction with the central control system: Receive and execute mobile authorization and line description information from the radio block center (RBC) to ensure the safe operation of the train within the jurisdiction of the RBC.

[0090] System functions of high-speed railway ATP system: The ATP system includes core functions such as speed monitoring, automatic braking control, communication with RBC, signal status monitoring and train status display.

[0091] Environmental conditions of high-speed railway ATP system: The system is suitable for high-speed railway operating environment, including train safety monitoring under various weather conditions and operating conditions.

[0092] Operating conditions of the high-speed railway ATP system: The system needs to be able to operate effectively in different speed monitoring areas and flexibly adjust the degree of braking intervention according to the operating mode to ensure the safety of high-speed railway trains.

[0093] The Radio Block Center (RBC) receives relevant information from other ground equipment and combines it with the information from the on-board equipment to generate a Movement Authorization (MA). Then, through the communication system, the RBC transmits information such as MA and line description parameters to the on-board equipment of the trains in its supervision area to ensure the safe operation of the trains within the jurisdiction of the RBC.

[0094] During the operation of the train, after the onboard equipment receives the MA command, ATP combines the train's own speed limit, braking characteristics and other train-related input information with line condition input information such as line basic parameters and speed limit parameters to calculate the speed supervision curve in real time, generate the current speed limit, monitor the train's running speed, and provide instructions through the train display. If the train speed is close to the current speed limit, ATP will issue an alarm to remind the driver to slow down; if the speed exceeds the speed limit, ATP will issue a braking command to automatically control the train to slow down.

[0095] How ATP works Figure 2 As shown in the figure, in the ATP system, the speed control function is divided into two modes according to the different human-machine relationships: driver braking priority (human control priority) and equipment braking priority (machine control priority). The human control priority mode is usually used in the ATP system in the non-full monitoring (FS) mode, while the machine control priority mode is used in the ATP system in the full monitoring mode. According to the change in the allowed speed, the speed monitoring area can be divided into the ceiling speed monitoring area (CSM area) and the target speed monitoring area (TSM area). The CSM area refers to the area where the speed is allowed to be constant, while the TSM area refers to the area where the speed is allowed to gradually decrease to a certain speed limit or 0km / h.

[0096] When the train is overspeeding, the control principle of the ATP system is as follows:

[0097] 1. Triggering the sound and light alarm: When the train speed exceeds the alarm speed, the ATP system will sound the sound and light alarm regardless of whether the braking control mode is human-controlled or machine-controlled, and regardless of whether the train is in the CSM area or the TSM area. The sound and light alarm will continue until the train speed drops below the alarm speed for 2 seconds.

[0098] 2. Output brake signal: In the human control priority mode, the braking process of the ATP system is the same in the CSM area and the TSM area. When the train speed exceeds the common brake intervention speed, the system will output the maximum common brake until the train speed drops below the allowed speed. The driver can press the "allow relief button" to stop the output of the maximum common brake. If the train speed exceeds the emergency brake intervention speed, the ATP system will trigger the emergency brake until the train stops completely. The emergency brake will be released only after the driver presses the "allow relief button". In the machine control priority mode, in order to avoid frequent triggering of the maximum common brake, the TSM area adds weak common brake and medium common brake. When the train speed exceeds the weak common brake intervention speed, the medium common brake intervention speed and the maximum common brake intervention speed in turn, the ATP system will output the corresponding brakes in turn. If the train speed continues to increase and exceeds the emergency brake intervention speed, the system will output all levels of common brakes and emergency brakes at the same time. The relief conditions are the same as those in the human control priority mode. After the driver presses the "allow relief button", all levels of brakes are released together.

[0099] The detailed braking control mechanism is as follows: The output sequence of weak common braking, medium common braking and maximum common braking: When the train speed exceeds the corresponding intervention speed, the ATP system outputs weak common braking, medium common braking and maximum common braking in sequence. When the train speed drops below the maximum common braking intervention speed, the medium common braking intervention speed and the allowed speed, the system will stop these braking outputs in sequence. Emergency braking triggering conditions and relief mechanism: If the train still accelerates when the maximum common braking, medium common braking and weak common braking are output at the same time, the ATP system will trigger emergency braking when the speed exceeds the emergency braking intervention speed. The conditions for relieving emergency braking are consistent with the human control priority mode. After the driver presses the "allow relief button", all braking measures are released together. Through the above control mechanism, the ATP system can effectively monitor and control the train speed, ensure that the train runs within a safe range, and prevent dangerous situations caused by speeding.

[0100] For the ATP system, the unsafe control actions are analyzed in the following parts.

[0101] 1. Analyze incidents, hazards, and system-level safety constraints

[0102] An incident represents a safety issue in the system. For an ATP system, possible incidents include:

[0103] A1: Train collision

[0104] A2: Rear-end collision

[0105] A3: Emergency braking causes passenger injury

[0106] A4: Derailment

[0107] A hazard is a system state that, in combination with an unsafe control action, could lead to an accident as described above.

[0108] The analysis results of the above four accidents are as follows:

[0109] H1: Speeding, may lead to A1, A2, A4.

[0110] H2: Improper brake control may lead to A1, A2, A3, A4.

[0111] H3: Train position detection error may lead to A1, A2.

[0112] H4: Communication failure, may lead to A1, A2.

[0113] Based on these hazards, the following system-level safety constraints (SC) are proposed and associated with the relevant hazards (indicated by numbers). These safety constraints cannot be violated, otherwise accidents may occur:

[0114] SC1: Once the train exceeds the speed limit, it must slow down. (Related danger: H1)

[0115] SC2: When the train is too close to the vehicle ahead, it must slow down. (Related hazard: H2)

[0116] SC3: The corresponding braking level should be applied according to the overspeed level. (Related hazard: H2)

[0117] 2. Identify unsafe control behaviors

[0118] Unsafe control actions (UCAs) are control measures that may lead to danger in certain situations. For the ATP system, 10 unsafe control actions are identified, as shown in Table 1.

[0119] Table 1 Unsafe control behaviors

[0120]

[0121]

[0122] 3. Security requirements

[0123] Loss scenarios describe the possible causes of unsafe control actions and hazards. The controller requirements can be directly derived from the unsafe control actions (UCA1–UCA10) as shown in Table 2:

[0124] Table 2 Safety requirements

[0125]

[0126] These safety requirements ensure that the ATP system can correctly control the train in critical situations to avoid danger and accidents. Specifically, S102 generates the FSM of the ATP system based on the results of STPA analysis using the CoFI method. The system under test (SUT) is the core object of the test. It is assumed that there is a test system at a higher level of abstraction that is responsible for executing one or more test cases. The test structure consists of the SUT and the test system, which communicate through PCOs (control and observation points). It is assumed that the SUT processes events generated by the interaction between components and the interaction between the environment and system components. Events that trigger the SUT to respond are called input events, and these input events cause the SUT to generate corresponding outputs. These outputs are considered observable output events or actions. Control points are where input events trigger or enter the SUT, and observation points are where the test system can observe output events. The control structure provides information about PCOs, input and output events. The places in the control structure that are responsible for receiving or sending control, feedback, and information flows are considered PCOs.

[0127] The control structure of the test system and SUT is as follows Figure 3 As shown in Table 3, the system under test contains 18 PCOs. The arrows indicate the information being transmitted, and the text shows the information or actions being transmitted in the PCOs. Due to space limitations, not all PCOs are shown.

[0128] Table 3 PCOs table

[0129]

[0130] 2.1 Symbolic Finite State Machine Definition

[0131] The state diagram used in the embodiment of the present invention is based on the Mealy machine. In the Mealy machine, the output value is determined by the current state and the current input. The Mealy machine is a deterministic finite state converter: under each combination of state and input, there is at most one possible transition. The Mealy machine consists of six elements:

[0132] 1. Finite set of states 2. Initial state 3. Input alphabet 4. Output alphabet

[0133] 5. Transition function that maps states and input symbols to corresponding next states

[0134] 6. Output function that maps state and input symbols to corresponding output symbols

[0135] When an input event occurs in a state, the finite state machine (FSM) generates an output event and moves to another state. First, the initial state of the system, the default state, is determined, and then transitions and states are identified through iteration. The STPA process model and its variables and values, as well as the changes in the controlled process, provide data for identifying the FSM states. In the ATP system, each controller has a set of process model variables. For example, a speed monitor will have two variables (overspeed, normal speed). The value changes of these process model variables can be represented as transitions of the FSM. Transitions and states are identified based on the events that occur at the PCOs. Five rules were developed by systematizing the identification of transitions, which help build the FSM. These rules are represented as pairs of input events / output events, as follows:

[0136] Transitions that result from feedback, external communication, or control actions by a higher level controller. Rule 1 is as follows: Receive feedback from the train speed monitor, control action or update variable, controller issues corresponding control action. Update and issue control action are output events in a single transition. Transitions that result from sensors, control actions, and execution actions. There are three rules, as follows:

[0137] The sensor detects a change in some variable and transmits it to the controller. This transformation is represented by Rule 2: The sensor detects a change in the controlled process / the sensor sends feedback to the controller (Ru2).

[0138] The actuator receives the control action and passes the execution to the controlled process. This transition is represented by Rule 3: The actuator receives the control action / the actuator causes the execution of the controlled process (Ru3).

[0139] The controlled process receives an execution from the actuator, which causes the controlled process to change. This rule is represented by Rule 4: The controlled process receives an execution from the actuator (Ru4).

[0140] Transition caused by system input. System input represents a change in the state of the controlled process, which is later detected by a sensor. The definition rule is as follows: The controlled process senses a system input event (Ru5).

[0141] These rules enable the systematic identification and construction of finite state machine graphs.

[0142] 2.3 Constructing the FSM diagram of normal behavior

[0143] The FSM diagram of the normal behavior category represents the behavior of the system when the service is provided correctly. In order to make the FSM diagram simpler and easier to handle, the normal behavior category can be represented in different scenarios. Each FSM diagram represents a scenario. Scenarios include train speed monitoring, dynamic calculation of the train speed supervision curve based on the position of the train and the status of the line, etc.

[0144] See also Figure 4 As shown, it is a normal behavior FSM diagram of train speed monitoring according to an embodiment of the present invention, which describes the sequence of transitions and indicates the rules applied. The FSM shows the time sequence of events that occur in the system (and its components) and flow through PCOs. The names of events and states are shown in italics, and the rules are shown in brackets. Considering the first start event, the train communicator works, resulting in the input event "train receives movement authorization" triggering the action "receive movement authorization" (Ru2). The next state is "ATP calculates speed limit". In this state, the train speed monitor calculates the speed limit and updates it, resulting in the input event "derive speed limit" triggering the action "speed monitor monitors speed" (Ru1). The next state is "monitor speed". In this state, the train speed monitor does not detect speeding, triggering the input event "no speeding" triggering the action "continue driving". (Ru2). The next state is "normal form". In this state, after the train travels out of the authorized section, the input event "exit section" triggers the action "issue a new movement request" (Ru5). Finally, it returns to the initial state.

[0145] 3. Construct the FSM diagram of abnormal behavior

[0146] Three types of abnormal behaviors are considered in CoFI: specified anomalies - anomalies that can be foreseen in the system under test; latent behaviors - behaviors triggered by foreseeable input events occurring at unexpected times; and fault tolerance - abnormal behaviors caused by hardware failures, which are usually handled by fault tolerance techniques.

[0147] Specified exception behaviors are those that are different from normal behaviors but are predictable in some way. To build a specified exception FSM, first use the normal behavior FSM and then add transitions caused by input events in the specified exception scenario. The following is a detailed description of each exception behavior:

[0148] Specified exceptions: These are the abnormal behaviors that can be expected in the system under test. Based on the FSM of normal behavior, transitions caused by input events of specified abnormal scenarios are added.

[0149] Latent behavior: This behavior is caused by foreseeable input events that occur at unexpected times. You need to consider these unexpected moments and reflect these potential abnormal behaviors in the FSM.

[0150] Fault Tolerance: Fault tolerance exceptions are caused by hardware failures. Usually, these exceptions are handled by fault tolerance techniques. These hardware failure scenarios and their handling methods are included in the FSM.

[0151] These steps can be used to systematically identify and construct finite state machine diagrams of abnormal behaviors, so that the FSM can comprehensively describe the behavior of the system under different abnormal scenarios.

[0152] See also Figure 5 As shown in FIG. 1 , it is a FSM diagram of the specified abnormal behavior of the train speed monitoring in an embodiment of the present invention. When the speed is monitored, the train will exceed the speed limit, causing the ATP system to sound an alarm and enter the alarm state. In the alarm state, two behaviors may occur. One is that a person receives the alarm and brakes manually. The other is an abnormal situation where the overspeed alarm is not handled for a long time. At this time, ATP will use mechanical control braking. Finally, when the speed in both states tends to be normal, the braking will stop and return to the normal driving state.

[0153] Potential behavior is an unexpected behavior that may occur in the operation of the system. It is triggered by known input events, but is unexpected in the current state. In order to identify potential path behaviors, a comprehensive analysis of all inputs involved in each state of the FSM is required. This analysis is achieved by using a state transition table (STT).

[0154] Construct a state transition table (STT), using the FSM transitions for normal behavior and specified abnormal behavior. For example, Table 4 shows an excerpt of an STT with three input events and three states.

[0155] Table 4 STT table

[0156]

[0157] Next, fill in the empty cells in the table, identify events that may occur at unexpected times, and determine potential path transitions. This process includes: Comprehensive analysis of all possible inputs for each state: Check all input events that may occur in each state; Identify events that occur at unexpected times: Determine which events are unexpected in the current state; Determine potential path transitions: Based on the above analysis, identify potential state transition paths; After identifying potential path transitions, draw a FSM diagram of potential behavior, which includes all newly identified transitions, so that the FSM can fully describe the behavior of the system under different abnormal scenarios.

[0158] For example, in the ATP system, the train alarm state may issue the same command again, see Figure 6 Shown is the FSM diagram of this potential path.

[0159] Fault-tolerant behavior takes into account the different failures that can occur in physical devices that can cause the system to fail or trigger fault-tolerant mechanisms. Assumptions about how the system should behave in the event of a sensor or actuator failure are necessary to anticipate safety requirements and constraints on the system's functionality and operation. This step helps design the appropriateness of hardware fault-tolerant mechanisms, as well as any other actions that keep the system running.

[0160] For ATP systems, components may fail. For example, Req9 may involve the failure of trackside equipment. When the trackside equipment fails, it may cause incorrect communication information, resulting in failure to meet safety requirements. In CoFI, fault tolerance mechanisms are also modeled in FSM. For example, consider the additional requirement: "ATP systems must have redundant sensors" In order to meet the requirements, consider that the system has two sensors in working state. In this case, the input event related to the fault is "sensor failure". The physical fault event does not necessarily occur in the current PCO, but it is also one of the failures that cannot be ignored in the overall system. Through the fault tolerance mechanism, the FSM of the ATP system has two operating sensors. When a fault event occurs for the first time in one of the sensors, a transition to the corresponding state can be added. When the event occurs for the second time, the system enters the error state again. In this way, the finite state machine diagram of abnormal behavior can be systematically identified and constructed to ensure that the system's response in various abnormal situations is fully considered and modeled.

[0161] 4. Verify and supplement FSM to meet STPA requirements

[0162] In this step, it is verified whether the FSM has considered the requirements identified by STPA and supplemented the parts that have not been considered, focusing mainly on the safety requirements (Req1–Req10) derived from the UCAs (unsafe control actions) identified by STPA.

[0163] Verify "must provide" type requirements. For "must provide" type requirements, determine the required control action and the scenario. For example, Req1 (ATP system must issue a deceleration command in the event of overspeed). Find the state related to the scenario and ensure that the corresponding output event occurs. If the occurrence of the output event cannot be ensured, a transition to the error state will be added.

[0164] Verify "shall not provide" type requirements. For "shall not provide" type requirements, also identify the required control action and the scenario. For example, Req3 (ATP system cannot arbitrarily apply deceleration or emergency braking.). Look for states related to the scenario and ensure that the provided control action never occurs in the transition. If the provided control action occurs in the transition, the next state must be an error state.

[0165] Verify requirements of the type "must not be provided too late", "must not be provided too early", "must not be provided for too long", "must not be provided for too short a time", etc. These types of requirements require the same reasoning process. Consider the case where the control action is continuous and has a duration. For example, the duration of a brake application. Check the transitions of the FSM to ensure that the control action is not provided too late, too early, for too long, or for too short a time. If these conditions are violated, add the corresponding error states.

[0166] Integrate different types of requirements. For ATP systems, the requirement of "must not provide control actions" usually includes requirements of the types of "must not provide too late", "must not provide too early", "must not provide too long", "must not provide too short", etc. These requirements will create corresponding error states in the FSM of the specified exception.

[0167] Verify and supplement the FSM. Verification of "must provide control action" and "must not provide control action" type requirements is usually only done in the normal behavior FSM. Extend the existing FSM to include behaviors that meet these requirements. Verify that unsafe control actions are met through construction or inspection of the FSM. Review the FSMs in light of these requirements to ensure that they adequately account for the requirements of STPA.

[0168] Specifically, S103 generates test cases using the Wp method on the generated FSM, which is described in detail as follows.

[0169] 3.1 Feature Set W

[0170] In Finite State Machine (FSM) based testing, feature set is a key concept for generating effective test cases. The feature set is usually denoted as W and is derived from the FSM.

[0171] Let M = (X, Y, Q, q1, δ, O) be a minimal complete FSM, where X is the input alphabet, including all input events (input expressions) in the system, and Y is the output alphabet, including all output events (output expressions) in the system. Q is the state set, q1 is the initial state, δ: Q×X→Q is the next state or state transition function, and O: Q×X→Y is the output function. The examples in this step are all based on Figure 7 For example, in order to simplify the following article, x and y are used to represent input events, and 0 and 1 are used to represent output events. The following is just a simple example, and a simple state machine is made to illustrate. Specifically, x represents the application of the braking command (human control or machine control), and y represents the event of speed change. 0 represents the output of continuous braking force, and 1 represents the change of output braking force. There are 5 states.

[0172] The feature set W is a set of finite input sequences that can distinguish any pair of state behaviors. In other words, for any state q i and q j , there exists a string s belonging to W such that after applying s, states qi and qj produce different outputs. This makes feature sets an important tool for generating effective test cases.

[0173] The algorithm for constructing the feature set of a finite state machine M consists of two main steps. First, a set of k-equivalence partitions P1, P2, ..., Pm, where m>0, is constructed. This iterative step converges in at most n steps, where n is the number of states in M. In the second step, these k-equivalence partitions are traversed in reverse order to obtain a distinguishing sequence for each pair of states.

[0174] For this finite state machine, the given feature set W is as follows:

[0175] W={x,xx,xxx,yxxx}

[0176] Let's do a sample check to determine if W is indeed the characteristic set of M. Consider the string yxxx. It is easy to verify from the figure that when M is in state q1 and stimulates input yxxx, the generated output sequence is 1101. However, when M is in state q2 and stimulates input yxxx, the generated output sequence is 1100. Therefore, we see that O(yxxx,q1)≠O(yxxx,q2), which means that the string yxxx is a distinguishing sequence of states q1 and q2.

[0177] 3.2 Identification set Wi

[0178] The recognition set Wi of state qi is a subset of W and has the following properties:

[0179] (a) For 1≤i≤n; (b) for any j≠i, s∈Wi, O(qi,s)≠O(qj,s); (c)Wi is the smallest subset that satisfies property (b). Consider the state set and its feature set W in 3.1. State q1 can be distinguished from other states by the strings baaa, aa, and a. Therefore, W1={yxxx,xx,x}. Similarly, W2={yxxx,xx,x}, ​​W3={x,xx}, W4={x,xxx}, W5={x,xxx}

[0180] 3.3 Calculation of transition cover set

[0181] Assume q i and q j (i≠j) are two states in the FSM M. The transition cover P contains sequences a and b such that:

[0182] δ(q0,a)=q i

[0183] δ(q i ,b)=q j

[0184] As its name transition cover indicates, after the FSM uses all elements in P, each time starting from the initial state, the FSM can reach every state. And the FSM uses P to cover all transitions.

[0185] In addition, the empty sequence ε is also in P. The transition cover set P can be generated by constructing a "test tree" of the FSM, which is a tree representation of the FSM state transitions, see Figure 8 As shown, the construction steps are as follows:

[0186] Initial state: q0 is the root node of the test tree.

[0187] Extension Node:

[0188] Assume that the test tree has been constructed to the kth level. The k+1th level is constructed as follows:

[0189] Select a node n at layer k.

[0190] If n appears in any level from level 1 to level k, then n is a leaf node and is not expanded further.

[0191] If n is not a leaf node, expand it by adding a branch from node n to a new node m for each x∈X, where δ(n,x) = m. This branch is labeled x.

[0192] Repeat this step for all nodes in layer k.

[0193] As in the state machine in 3.1, the initialization of the test tree sets the initial state q1 as the root node. This is the first level of the tree. Next, note that δ(q1,x)=q1 and δ(q1,y)=q4, so two nodes are created in the next level and labeled q1 and q4. The branches from q1 to q1 and q4 are labeled x and y respectively. Since q1 is the only node in level 1, the tree is now expanded from level 2. At level 2, the node labeled q1 is first considered. However, another node labeled q1 has already appeared in level 1, so this node becomes a leaf node and is not expanded further. Next, the node labeled q4 is checked. Note that δ(q4,x)=q3 and δ(q4,y)=q4. Therefore, two new nodes are created in level 3 and labeled q4 and q3, and the corresponding branches are labeled y and x. In a similar way, one level is expanded downward each time. When nodes labeled q1 and q5 appear in level 6, the method converges. Therefore, the test tree of the FSM shown in the figure above is obtained. Once the test tree is constructed, the transition cover P is obtained by concatenating the labels of all partial paths in the tree.

[0194] A partial path is a path that starts from the root of the test tree and ends at any node of the tree. Traversing all partial paths in the trees in the graph yields the following transition cover.

[0195] P={ε,x,y,yy,yx,yxy,yxx,yxxy,yxxx,yxxxy,yxxxx}.

[0196] 3.4Wp Method

[0197] The Wp method, also called the partial W method, is similar to the W method in that they both generate tests from a minimal, complete, and connected finite state machine (FSM). However, the size of the test case set generated using the Wp method is usually smaller than that generated using the W method. This reduction is achieved by splitting the test generation process into two stages and using the state identification set Wi instead of the feature set W in the second stage. In addition, the fault detection effect of the Wp method is the same as that of the W method.

[0198] First, define the state cover set S of the FSM M=(X,Y,Q,q1,δ,O). S is a finite non-empty set of sequences. For each state qi∈Q, there exists r∈S such that δ(q0,r)=qi. It is easy to see that the state cover set is a subset of the transition cover set and is not unique. It should be noted that the empty sequence ε belongs to S, which covers the initial state, because according to the definition of state transition, δ(q0,ε)=q0. From the above, we can see that: P=θ,x,y,yy,yx,yxy,yxx,yxxy,yxxx,yxxxy,yxxxx, and the following subsets of P form a state cover set of M: S=ε,y,yx,yxx,yxxx.

[0199] The following content shows how to use the Wp method to generate test cases. First, M represents the reference model corresponding to the IUT (system under test), which represents the real system in the test. M contains n states (n>0), and IUT contains m states (m>0).

[0200] In this method, there is no need to use FSM to model the system. The above M is the FSM of normal behavior generated in S102, which represents the real system and processes all input events correctly. IUT is the FSM that contains normal behavior and abnormal behavior. Since the FSM of abnormal behavior may generate additional states, the IUT here contains m states, and m may be greater than n.

[0201] The test case set T derived using the Wp method consists of subsets T1 and T2, i.e., T = T1 ∪ T2. The following steps show how to obtain subsets T1 and T2, assuming that M and IUT have the same number of states, i.e., m = n.

[0202] The test case generation steps for the Wp method are as follows:

[0203] Step 1: Calculate the transition cover set P, state cover set S, feature set W, and state recognition set W of FSM M i Recall that S can be derived from P, and the state recognition set can be computed as described in 3.2.

[0204] Step 2: T1 = S·W.

[0205] Step 3: Let W be the set of all state recognition sets of M, that is, W = {W1, W2, ..., W n}.

[0206] Step 4: Let R = {r i1 ,r i2 ,...r ik} represents the set of all sequences in the transition cover set P but not in the state cover set S, that is, R = PS. In addition, let r ij ∈R satisfies δ(q0,r ij )=q ij .

[0207] Step 5: Where W ij ∈W is the state q ij The state identification set.

[0208] After generating the test set T consisting of subsets T1 and T2, continue testing the IUT as described in the next section. The operator is called the sequence concatenation operator.

[0209] Specifically, S104 includes a two-stage test process. In the first stage, the IUT is tested using the elements in T1. In the second stage, the IUT is tested using the elements in T2.

[0210] Phase 1: Test the IUT with each element in T1 to check whether each state is equivalent to the corresponding state in M. This requires that the state cover set S and feature set W of M are equivalent to those in the IUT. Therefore, the test sequence t in T1 is in the form of uv, where u∈S and v∈W. S is the state cover set, which ensures that the test can reach every state in the system. Therefore, apply u in t to M to determine whether the state cover set S holds for the IUT. W is a feature set used to identify whether the test has reached the expected state, and continue to apply v in t to M to determine whether the feature set holds. If the IUT behaves the same as M for each element in T1, they are equivalent in terms of S·W. If not, there is an error in the IUT.

[0211] Phase 2: Although testing the IUT with elements from T1 can check the equivalence of all states in it with states in M, it may miss checking transitions in the IUT. This is because T1 is generated using the state cover set S instead of the transition cover set P. So the elements in T2 check the remaining transitions in the IUT.

[0212] Each element t in T2 is also of the form uv, where u belongs to P but not S. Therefore, applying u in t to M overwrites every transformation of it. Suppose that after executing u, M is in q i State, now test v, where v belongs to W i , which is the state recognition set of qi, so the test part will be q i It is distinguished from all other states and further tested for transitions that were not tested when T1 was tested. Therefore, using T2 will reveal transmission or operation errors in transitions that were not tested by T1.

[0213] For example, consider M in Section 3.1. First, the various sets needed to generate the test set T are as follows:

[0214] W={x,xx,xxx,yxxx},P={θ,x,y,yy,yx,yxy,yxx,yxxy,yxxx,yxxxy,yxxxx},S={θ,y,yx ,yxx,yxxx}, W1={yxxx,xx,x}, ​​W2={yxxx,xx,x}, ​​W3={x,xx}, W4={x,xxx}, W5={x,xxx}.

[0215] Calculate set T1 according to step 2.

[0216] T1=S·W={x,xx,xxx,yxxx,yx,yxx,yxxx,yyxxx,yxx,yxxx,yxxxx,yxyxxx,yxxx,yxxxx,yxxxxx,yx xyxxx,yxxx,yxxxxx,yxxxxxx,yxxxyxxx} According to step 4, get R as follows:

[0217] R=PS={x,yy,yxy,yxxy,yxxxy,yxxxx}

[0218] According to step 4, the state transition of the elements in R is as follows:

[0219] δ(q1,x)=q1

[0220] δ(q1,yy)=q4

[0221] δ(q1,yxy)=q1

[0222] δ(q1,yxxy)=q5

[0223] δ(q1,yxxxy)=q5

[0224] δ(q1,yxxxx)=q1

[0225] Notice from the transitions given above that when M is tested with elements x, yy, yxy, yxxy, yxxxy, and yxxxx, each time starting from state q1, it moves to states q1, q4, q1, q5, q5, and q1, respectively. Therefore, the state recognition sets W1, W4, and W5 need to be considered when calculating T2. Using the formula in step 5, T2 is obtained as follows:

[0226]

[0227] ={xyxxx,xxx,xx}∪{yyx,yyxxx}∪{yxyx,yxyxxx}∪{yxxyx,yxxyxxx}∪{yxxxyx,yxxxyxxx}∪

[0228] {yxxxxyxxx,yxxxxxx,yxxxxx}

[0229] The required test set T = T1∪T2. T contains a total of 21 tests.

[0230] For example, suppose that M is given as shown in 3.1, and one needs to test the value corresponding to Fig. 9The IUTs of M1 and M2 are designed in (a) and (b). For each test, two phases of testing are performed according to the requirements of the Wp method. In Figure (a), there is a transmission fault, and in Figure (b), there is both a transmission fault and an output fault. The specific conditions are shown in red in the figure.

[0231] Test M1, first stage: Apply each element t in T1 to the IUT corresponding to M1 and compare M1(t) with the expected response M(t). To simplify this example, consider test t=yxxxxxx, resulting in M1(t)=1101001. In contrast, the expected response is M(t)=1101000. Therefore, test t reveals a transmission error in state q2.

[0232] Phase 2: In practice, there is no need to test M1 at this stage, as the error has been revealed in Phase 1. However, in practice, all elements in T2 should be tested on M1 to ensure safety.

[0233] Test M2, first stage: test t=yxxyxxx, reveals the error because M2(t)=1100100 and M(t)=1101000.

[0234] Test M2, second stage: Also to ensure safety, execute T2 again.

[0235] In both cases in the above examples, it was not necessary to apply the second phase of the Wp method to reveal the error. However, in real situations it is not certain whether the first phase is sufficient, so it is necessary to apply all the tests of both phases.

[0236] The process of constructing a test using the Wp method can be applied when the number of states of the IUT is greater than the number of states of the real system, that is, when m>n. Only steps 2 and 5 of the previously described process need to be modified. For m=n, calculate T1=S·W. For m>n, modify this formula so that T1=S·Z, where Z=X[mn]·W.

[0237] The W method is a classic test generation technique that ensures the comprehensiveness of the test by covering all states and transitions in the model. In order to achieve comprehensive coverage, the W method usually generates a large number of test cases, especially when the system states are numerous or complex. The Wp method is an optimized version of the W method, which aims to reduce the number of test cases generated and avoid generating redundant or repeated test cases by intelligently selecting test sequences. Compared with the W method, the Wp method can not only act on non-deterministic systems, but also significantly reduce the number of test cases generated and improve test efficiency. Based on the ATP system of this application, since the ATP system is a non-deterministic system, if the W method is used, it is necessary to apply other technologies to the ATP system in advance to convert it into a deterministic system before testing, which undoubtedly increases the test duration. This problem will not be considered when using the Wp method. Because it is based on transition coverage sets, test errors will not be caused by non-deterministic states in non-deterministic systems. At the same time, the Wp method usually also shortens the number of test cases. For example, in the example of this embodiment, assuming that M and IUT have the same number of states, that is, m=n, applying the Wp method will generate 21 test cases, but if the W method is applied, 29 test cases will be generated, as shown below: T=P·Z={ε,x,y,yy,yx,yxy,yxx,yxxy,yxxx,yxxxy,yxxxx}·{x,xx,xxx,yxxx}={x,xx,xxx,yxxx,xx,xxx,x xxx,xyxxx,yx,yxx,yxxx,yyxxx,yyx,yyxx,yyxxx,yyyxxx,yxx,yxxx,yxxxx,yxyxxx,yxyx,yxyxx,yxyxxx,y xyyxxx,yxxx,yxxxx,yxxxxx,yxxyxxx,yxxyx,yxxyxx,yxxyxxx,yxxyyxxx,yxxxx,yxxxxx,yxxxxxx,yxxxyxxx yxxxyx,yxxxyxx,yxxxyxxx,yxxxyyxxx yxxxxx,yxxxxxx,yxxxxxxx,yxxxxyxxx}.

[0238] 3.5Z Structure

[0239] Given an input alphabet X and a feature set W, constructing Z is straightforward. Assume that the estimated number of IUT states is m and the number of states in the designed system under test is n, with m ≥ n. Based on this information, Z can be calculated as follows:

[0240] Z=(X 0 ·W)∪(X·W)∪(X 2 W)∪…∪(X m-1-n ·W)∪(X m-n ·W)

[0241] where X 0 ={ε}, X 1 = X, X 2 = X·X, and so on, where the symbol "·" represents the string concatenation operation.

[0242] It is easy to see that when m = n, i.e., the number of states in the IUT is the same as the number of states in the system under test, Z = W. For m < n, Z = X·W is used. For convenience, the shorthand X[p] will be used to represent the following set union: {ε} ∪ X 1 ∪ X 2 … ∪ X p-1 ∪ X p . Now, Z can be rewritten as Z = X[m - n]·W, where m is the number of states in the IUT and n is the number of states in M.

[0243] T1 is used in the first stage of the test process. T1 is different from T generated from the W method because it uses the state coverage set S instead of the transition coverage set P. Therefore, T1 contains fewer tests than T, unless P = S.

[0244] To calculate T2, first calculate R as in step 4. R contains only the elements in the transition coverage set P that are not in the state coverage set S. Let R = P - S = {r i1 , r i2 ,... r ik}. r ij ∈ R moves M from its initial state to state q ij , i.e., δ(q0, r ij ) = q ij . Given R, T2 is derived as follows.

[0245]

[0246] where δ(q0, r ij ) = q ij , δ(q ij , u) = q l , and W l ∈ W is the recognition set of state q l .

[0247] The basic idea of the second stage is as follows. Perform a test on the IUT under test to make it reach a certain state q i from the initial state q0. Let u represent the input sequence that moves the IUT from state q0 to q i . Since the IUT contains m > n states, (m - n) more transitions must now be performed. Therefore, (m - n) inputs are needed to make the IUT perform so many transitions. Let v represent the input that moves the IUT from state qi Move to state q j Finally, let w denote the state recognition set W j Therefore, a test of the IUT in the second phase consists of the input sequence uvw.

[0248] The expression for computing T2 consists of two parts. The first part is R, and the second part is the concatenation of X[mn] and W. Therefore, a test in T2 can be written as uvw, where u∈R is the value that moves the IUT from its initial state to some state q. i The sequence v∈X[mn] is to move the IUT further to the additional state q j sequence, w∈W j is to move it to a certain state q l If the IUT has no errors, then the output generated by the IUT when receiving the input uvw must be the same as the output generated when the reference model M uses the same input.

[0249] For example, using the Wp method Fig.10 Construct a test set for the machine M in T, assuming that the corresponding IUT contains an additional state. For this case, n = 5 and m = 6, the various sets required to derive T are re-listed as follows:

[0250] X={x,y}

[0251] W={x,xx,xxx,yxxx}

[0252] P={θ,x,y,yy,yx,yxx,yxy,yxxy,yxxx,yxxxy,yxxxx}

[0253] S={θ,y,yx,yxx,yxxx}

[0254] W1={yxxx,xx,x}

[0255] W2={yxxx,xx,x}

[0256] W3={x,xx}

[0257] W4={x,xxx}

[0258] W5={x,xxx}

[0259] First, according to the above, T1 = S·X[1]·W. X[1] represents the set {θ}∪X 1 .

[0260] T1=S·(θ∪X 1 )·W

[0261] =(S·W)∪(S·X·W)

[0262] Where:

[0263] S·W = {x, xx, xxx, yxxx, yx, yxx, yxxx, yyxxx, yxx, yxxx, yxxxx, yxyxxx, yxxx, yxxxx, yxxxxx, yxxyxxx, yxxx, yxxxxx, yxxxxxx, yxxxyxxx}

[0264] S·X = {x, y, yx, yy, yxx, yxy, yxxx, yxxy, yxxxx, yxxxy}

[0265] S·X·W = {xx, xxx, xxxx, xyxxx, yx, yxx, yxxx, yyxxx, yxx, yxxx, yxxxx, yxyxxx, yyx, yyxx, yyxxx,

[0266] yyyxxx, yxxxxx, yxxxx, yxxxxx, yxxyxxx, yxyx, yxyxx, yxyxxx, yxyyxxx, yxxxx, yxxxxx, yxxxxxx, yxxxyxxx, yxxyx, yxxyxx, yxxyxxx, yxxyyxxx, yxxxxx, yxxxxxx, yxxxxxxx, yxxxxyxxx, yxxxyx, yxxxyxx, yxxxyxxx, yxxxyyxxx}

[0267] T1 contains a total of 60 tests, 20 of which are in S·W and 40 are in S·X·W. To obtain T2, R = P - S = {x, yy, yxy, yxxy, yxxxy, yxxxx} is obtained. Now T2 can be calculated as follows.

[0268]

[0269] = {xxyxxx, xxxx, xxx, xyx, xyxxx, yyxx, yyxxx, yyyx, yyyxxx, yxyxyxxx, yxyxxx, yxyxx, yxyyx, yxyyxxx, yxxyxyxxx, yxxyxxx, yxxyxx, yxxyyx, yxxyyxxx, yxxxyxyxxx, yxxxyxxx, yxxxyxx, yxxxyyx, yxxxxxyxxx, yxxxxxxx, yxxxxxx, yxxxxyx, yxxxxyxxx}

[0270] T2 contains a total of 38 tests. In the entire test set T = T1 ∪ T2, a total of 81 tests are included.

[0271] It can be seen that the present invention combines the STPA method with the CoFI method and the Wp method to provide a comprehensive and effective method for fault injection testing of the ATP system. First, the system is deeply analyzed by the STPA method to identify potential fault scenarios and influencing factors. Then, the CoFI method is used to inject these faults into the control flow graph of the system to generate the finite state machine (FSM) of the system. Finally, the Wp method is used to generate test cases from the FSM model of the system, especially for the uncertainty conversion part of the system, to verify whether the behavior of the system in the face of different fault conditions meets the design requirements, thereby ensuring the safety and reliability of the ATP system.

[0272] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A fault injection test method for high-speed railway ATP system based on STPA, characterized in that: The following steps are involved: Apply the STPA method to analyze the high-speed railway ATP system and identify failure scenarios and safety requirements; Based on the fault scenarios and safety requirements, the CoFI method is used to generate the finite state machine model FSM of the high-speed railway ATP system; Use the Wp method to generate test cases on the finite state machine model FSM; Use test cases to test the high-speed railway ATP system.

2. The fault injection test method for high-speed railway ATP system based on STPA according to claim 1 is characterized in that: The application of the STPA method to analyze the high-speed railway ATP system includes the following steps: Define the purpose of the high-speed railway ATP system and clarify the objectives and scope of the high-speed railway ATP system, including the system's functions, environment and operating conditions; Construct the control structure diagram of the high-speed railway ATP system, identify the controller, controlled object, sensor, actuator and their relationship in the system; Identify unsafe control actions in control structure diagrams and summarize safety requirements.

3. The fault injection test method for high-speed railway ATP system based on STPA according to claim 2 is characterized in that: The unsafe control behaviors include: The high-speed railway ATP system did not issue a deceleration command in the case of overspeeding; The high-speed rail ATP system failed to detect the train speeding; High-speed railway ATP systems misjudged speeding, leading to unnecessary deceleration or emergency braking; High-speed rail ATP systems trigger emergency braking when it is not necessary; The high-speed rail ATP system failed to trigger emergency braking when necessary; The high-speed railway ATP system failed to effectively release the brakes, resulting in continued braking; High-speed railway ATP systems report incorrect train positions, leading to incorrect control decisions; The high-speed rail ATP system failed to update train location data in real time; The communication between the high-speed railway ATP system and the trackside equipment is interrupted, and control instructions cannot be received or sent; Communication data errors between the high-speed railway ATP system and trackside equipment lead to wrong control decisions; The safety requirements include: The high-speed railway ATP system must issue a deceleration command in the event of overspeed; High-speed rail ATP systems must be able to detect train speeding; The high-speed railway ATP system cannot arbitrarily apply deceleration or emergency braking; The high-speed railway ATP system cannot trigger emergency braking at will; High-speed rail ATP systems must be able to trigger emergency braking when necessary; High-speed railway ATP systems must be able to effectively release brakes; High-speed rail ATP systems must report correct train positions; High-speed railway ATP systems must be able to update train location data in real time; The communication between the high-speed railway ATP system and the trackside equipment cannot be interrupted; The communication data between the high-speed railway ATP system and the trackside equipment cannot be wrong.

4. The fault injection test method for high-speed railway ATP system based on STPA according to claim 1 is characterized in that: Based on the fault scenario and safety requirements, the CoFI method is used to generate the finite state machine model FSM of the high-speed railway ATP system, including the following steps: Identify the observed control points (PCOs), input events, and output events in the control structure diagram of the high-speed railway ATP system; To construct the rules of the finite state machine graph, first determine the initial state of the high-speed railway ATP system, then iteratively identify transitions and states based on the events occurring at the observation control points PCOs, and finally establish the rules of the finite state machine graph based on the identified transitions and states; Construct normal behavior FSM diagram based on the rules of finite state machine diagram; Construct abnormal behavior FSM diagram based on failure scenarios and safety requirements; Add fault tolerance mechanism in FSM modeling process; Verify whether the constructed FSM diagram meets the STPA requirements. If not, supplement the FSM diagram.

5. The fault injection test method for high-speed railway ATP system based on STPA according to claim 4 is characterized in that: The abnormal behavior FSM diagram is constructed based on the fault scenario and safety requirements, specifically including: Add the transitions caused by the input events in the specified abnormal scenario to the normal behavior FSM diagram to construct the specified abnormal behavior FSM diagram; Construct a state transition table STT using the transitions of the FSM for normal behavior and the FSM for specified abnormal behavior, fill in the empty cells in the transition table STT, identify events that occur at unexpected times, determine potential path transitions, and draw a potential behavior FSM diagram that includes all newly identified transitions.

6. The fault injection test method for high-speed railway ATP system based on STPA according to claim 5 is characterized in that: The normal behavior refers to the behavior when the high-speed railway ATP system provides services correctly, and the abnormal behavior refers to the behavior when the high-speed railway ATP system does not provide services correctly; different services are represented by FSM diagrams of different scenarios; the services include train speed monitoring.

7. The fault injection test method for high-speed railway ATP system based on STPA according to claim 6 is characterized in that: The normal behavior FSM diagram construction process for the train speed monitoring scenario includes the following steps: Determine the initial state as the state of the train at normal speed; Iteratively identify transitions and states according to events occurring at the observation control points PCOs, specifically: the train communicator works, resulting in the input event "the train receives the movement authorization" triggering the action "received the movement authorization"; the next state is "ATP calculates the speed limit", in this state the train speed monitor calculates the speed limit and updates it, resulting in the input event "derives the speed limit" triggering the action "the speed monitor monitors the speed"; the next state is "monitoring speed", in this state the train speed monitor does not detect overspeeding, triggering the input event "not overspeeding" triggering the action "continue driving"; the next state is "normal form", in this state after the train drives out of the authorized section, triggering the input event "exiting the section" triggering the action "issuing a new movement request"; finally returning to the initial state; The normal behavior FSM diagram of the train speed monitoring scenario is established based on the identified transitions and states.

8. The fault injection test method for high-speed railway ATP system based on STPA according to claim 7 is characterized in that: The abnormal behavior FSM diagram of train speed monitoring is obtained by adding the conversion caused by the input event in the specified abnormal scenario to the normal behavior FSM diagram of the train speed monitoring scenario; the specified abnormal scenario is the overspeeding of the train, which causes the input event "overspeeding" to trigger the action "issuing an alarm"; the next state is the "alarm state", in which two situations may occur. The first situation is that when a person receives the alarm, the "manual braking" state is entered. In the "manual braking" state, after the train speed returns to normal, the input event "return to normal speed" is triggered to trigger the action "stop braking" and return to the normal driving state; the second situation is that if the overspeed alarm is not handled for a long time, the "machine control state" is entered to take machine control braking. After the train speed returns to normal, the input event "return to normal speed" is triggered to trigger the action "stop braking" and return to the normal driving state.

9. The fault injection test method for high-speed railway ATP system based on STPA according to claim 1 is characterized in that: The test case includes a first test set T1 and a second test set T2; the use of the test case to test the high-speed railway ATP system includes the following steps: Use the elements in the first test set T1 to test the IUT, and check whether each state is equivalent to the corresponding state in M. If yes, proceed to the next step; otherwise, consider that the IUT has an error and end the test; The IUT is tested using the elements in the second test set T2 to check whether each state is equivalent to the corresponding state in M. If so, it is considered that the IUT has no errors, otherwise it is considered that the IUT has errors and the test ends.

Images